Support for Salesforce Field Level Security

Objective

Information on Outreach Field Level Governance (FLG) support for automatic synchronization with Salesforce’s Field Level Security (FLS).

Applies To

• Governance
• Outreach Admins
   

Overview

Outreach Field Level Governance (FLG) now supports automatic synchronization with Salesforce’s Field Level Security (FLS). This allows any organization that are already using Salesforce’s Field Permissions to bring them over to Outreach as-is. As of November 2025, only Prospect, Account and Opportunity FLS will be supported.This makes it significantly easier for Outreach Admins to manage field specific permissions at scale as they use Outreach’s powerful FLG to control visibility and edit access on individual fields inside any record.

Field Level Governance is a powerful enhancement to our existing Role-Based Access Control (RBAC) Profile based governance system and provides granular control over data visibility (view/edit/hide) at the field level while RBAC continues to provide access to the overall Opportunity record. You can learn more about Field Level Governance here.

Setup

Prerequisite

Field Permissions are already set up and active in Salesforce.

Setting up permissions sync

To set up Field Level Security you’ll need to first set up Outreach’s CRM sync to bring over the Salesforce Permissions. To set up Salesforce sync, navigate to Administration > Integrations > CRM.

Next make sure to set up the following objects:

1. Salesforce Profile → Outreach Profile
2. Salesforce Field Permissions → Outreach Field Permissions

Make sure for both the objects you’re setting up all three – create, update and delete.

Objects supported through FLS

In this release Outreach will support Salesforce Contact, Lead, Opportunity and Account objects only. Outreach requires these objects to be pre-mapped before FLS can be enforced. Outreach will only enforce FLS for the objects that have been set up.

Fields supported through FLS

Outreach will apply FLS only for fields that have been mapped inside the CRM settings for the underlying object. Of those fields that are mapped, governance will be applied only for those fields that have Field Permissions set up in Salesforce.

For example, the Leads object might have 100 fields in Salesforce, but the Outreach admin has mapped only 20 of those fields inside Outreach Prospects objects. Of these 20 fields, only 10 fields have Field Permissions set in Outreach. In such a scenario, FLS will be applied only for those 10 fields.

Connecting Outreach Profiles to Salesforce Profile

Note: Before you can perform this part of the set up you need to ensure that Outreach has the chance to sync the Profile and Field Permissions object. Depending on how you have set up your sync intervals, this might take some time to show up. Once Outreach has had the chance to sync in the Profile and Field Permissions object, the next step is to link Outreach Profiles to Salesforce Profiles to make sure the correct permission sets are applied to the correct users.

To do this, navigate to Administration > User Management > Access Control > Pick up the Profile you want to set up with FLS and click on the Setup button under Field permission sync

From the dialog that pops, select the Salesforce Profile you want to associate with this Outreach Profile:

Once set up Outreach will start syncing in and setting permissions from Salesforce automatically. Note that this might take some time to apply depending on your CRM sync schedule.

You can navigate back to the Outreach Profile to see which fields have been enforced for the Profile or disconnect it

 Locally managed vs. FLS managed field permissions

In Outreach, Salesforce FLS gets precedence over any locally set up field permissions, or in other words, Salesforce FLS will override any field permissions that might have been set locally.

This override behavior only applies to fields that are mapped inside CRM settings for the underlying Contact, Lead, Opportunity or Account and has Field Permissions set. Outreach will ‘lock’ this fields out from local management UI.

Outreach will represent this ‘locked’ behavior in the UI for the fields that have FLS enforced:

For additional Outreach only fields, fields that have not been mapped in CRM or fields that don’t have Field Permissions set in Salesforce can continue to be managed locally in Outreach Profile.

If the Field Permissions are removed in Salesforce, then Outreach will ‘unlock’ the field to be managed locally and maintain whatever last permissions were enforced through FLS.

End user experience

The end user experience with Salesforce Field Level Security (FLS) is no different from Outreach’s native Field Level Governance implementation.

Please refer to Outreach’s Field Level Governance documentation to learn more.

Additional Information

Frequently Asked Questions

What is the difference between Outreach’s native Field Level Governance and support for Salesforce's Field Level Security?

From an end user POV, none. From an Admin POV, you can think of support for Salesforce Field Level Security as an automation for customers who have already set up Salesforce FLS. Outreach simply bring forwards and applies FLS permissions automatically.

What levels of permission can I control per field?

Admins are allowed to set ‘none’, ‘view’ and ‘edit’ permissions for fields associated with any object in Salesforce. Outreach will maintain the same permissions inside Outreach Profiles. 

Can I configure field permissions differently for different users?

Yes. Field Permissions are governed per Profile. You can create variations in field permissions by linking appropriate Salesforce Profiles to appropriate Outreach Profiles. 

Which fields are available to govern using Field Level Governance?

Most fields are supported except for internal or system control fields. To see the full list of fields you can go to any Profile > scroll down to Opportunity > Click on Manage field permissions. The FLG dialog will list all the fields supported in that object.

I’ve set up CRM sync for FLS but don’t see the permissions applied

Note that Outreach requires the field to be mapped in the parent object before FLS can be applied. Make sure the field is mapped in the underlying object.

For example, Outreach supports Opportunity Amount as a possible field for governance enforcement. You must map the ‘Amount’ field first by going to Administration > Integrations > CRM > Opportunity. This is a required step before the underlying Field Permissions can be applied.

Does this affect my locally set up Field Level Governance permissions?

It could. If you have set a field locally, that is also set up inside Salesforce Field Permissions, then Salesforce permissions will override Outreach’s locally set permissions.

Is this a paid feature?

Not at this moment. You might require specific licenses in Salesforce, but inside Outreach this is available for all licenses.

Is this feature opt-in or enforced by default?

This is an opt-in feature. FLS is not enforced till the Profile and Field Permissions are mapped and the underlying fields have been mapped in Prospect, Account and Opportunity objects. Sync also needs to be fully functional before Field Permissions can be applied.

How does this impact the ‘Required’ fields I’ve set up for Opportunities?

FLS is not allowed for any field that has been marked as Required. If a field is marked ‘Required’ after FLS has already been enforced, FLS will be automatically disabled. If a field is no longer marked ‘Required’ after FLS has already been set up, the field’s permission will be automatically set to reflect the RBAC permission of the parent object.

Will APIs also respect FLS?

Yes. While the feature is available through Salesforce CRM sync only, the underlying governance access control enforcement will be respected in Outreach APIs.

Are there any limitations I should be aware of?

In this release, only Prospects, Account and Opportunity objects are supported.

It is also important to note that Field Level Governance is supported inside specific Outreach controlled experiences and APIs only. The field might still be visible if you’ve any customized UI that Outreach doesn’t control, through integration endpoints, plugins, or for advanced users to work around outside of browser UI etc. It is also not enforced in scenarios where the field is used for backend calculations like, for example, Forecasting or Pipeline Summaries.